This is pretty much useless without knowing exactly what it was they told their bot to do in the first place. All we get are "example tasks" for what it should have done and a short list of things it was told not to do (which it followed).
> Claude Haiku 4.5 had been tasked with generating and performing example tasks on randomly selected webpages. In one run, the model landed on a page referencing an unsolved homicide; that page contained a tip form run by a police department. Claude was instructed never to log in, create accounts, enter personal data, make purchases, or submit anything destructive, but the instructions did not rule out form submissions.
Without more information this looks much less like an AI problem and more like yet another example of incompetent or malicious internal tests. Many people are using Claude. There are no other reports of police stations getting fake reports from AI.
Let’s just get comfortable that these kind of incidents are going to be commonplace. Kudos to the people sounding the alarms but I can’t help but feel skeptical about the ability to keep the rogue entities contained.
No, let's not get comfortable. Let's get angry at the fact that now we have hyperscalers acting with impunity, failing to properly sandbox their testbeds, and increasing the workload imposed on our public services.
Today it's a fake tip to the police and and exploit chain against Huggingface, but soon it could be an attack against a hospital's IT systems that could cost real lives immediately.
We should be locking things down, yes, but a hardened system is still vulnerable to zero day chains, and that's not unprecedented. Until public services have built up the IT defence capacity to deal with this, we cannot normalize this. If a country did this to another country, it should be treated as a war crime in the same way that targeting a hospital or an orphanage or other critical civilian infrastructure would be.
Complacency is a choice and we must not be complacent.
That would not be without precedent. When we decided that certain internet platforms were too big to moderate, we let them get away with hosting all kinds of illegal content.
The Chinese are not as flush with compute as to afford to just forget a few thousand agents running for a few weeks.
They also aren't the ones screaming about how close they are to destroying the world. They're approaching the tech like building a tool rather than a god.
OpenAI and Anthropic have shown us that they have a strong incentive to leave holes in their systems so they can use them for marketing and regulatory capture.
This sounds highly irresponsible. They set loose LLM agents with instructions to post data to randomly selected websites.
What it it submits false data as here?
What is it DDOSs a website by mistake?
What if it wastes a lot of time and resources?
What if it decides it needs to hack a website using a vulnerability it found?
These things are very unpredictable and should not be allowed in the open internet except in read mode (and even that doesn’t always work as we have seen).
Why are these tests being made using other people’s resources and polluting the common wealth of our public spaces with slop?
I presume Anthropic didn’t have any privileged access to any of these websites and services. What differentiates them from any other spam bots or people out there submitting junk to random POST endpoints?
Don’t get me wrong - think Anthropic is acting with not enough scrutiny or punishment here, but the world is already extremely lenient towards this behaviour. Why hold them to a higher standard?
I'm sorry, but how can you call it a test suite if it has access to the outside world and is able to submit requests? Sounds like they didn't even bother sandboxing to this time. This is the lamest example of "Rogue AI" I have seen so far.
Before you all start screaming negligence and irresponsibility and how-could-they-be-so-dumb, let's think about what we're observing.
These are relatively brand new systems that process an incredible amount of data to form their "world view". The word non-deterministic gets thrown around a lot, but you have to understand that there's absolutely nothing deterministic about these architectures. The only way to know that certain qualities could emerge is to observe the qualities emerging.
Giving an agent instructions that, for example, instruct it to only perform GET requests, and then observing that the agent does not always respect that request, is not a failure of security or configuration: it's data being gathered.
Yeah, we're going to become more diligent about the protections that we put in place beyond any level of protection that we've ever employed before. You can say that we have decades of security research and experience, but we're watching all of that fall more and more day by day, finally putting a real delta on how secure we thought we were versus how secure we actually are [1]. Additionally, adversaries have never existed inside of the systems that we hoped to secure in the first place.
So go ahead, enumerate all of the ways in which you think that you can lock down these systems, but do realize that nobody has actually solved this problem adequately yet.
> Claude Haiku 4.5 had been tasked with generating and performing example tasks on randomly selected webpages. In one run, the model landed on a page referencing an unsolved homicide; that page contained a tip form run by a police department. Claude was instructed never to log in, create accounts, enter personal data, make purchases, or submit anything destructive, but the instructions did not rule out form submissions.
Without more information this looks much less like an AI problem and more like yet another example of incompetent or malicious internal tests. Many people are using Claude. There are no other reports of police stations getting fake reports from AI.
Today it's a fake tip to the police and and exploit chain against Huggingface, but soon it could be an attack against a hospital's IT systems that could cost real lives immediately.
We should be locking things down, yes, but a hardened system is still vulnerable to zero day chains, and that's not unprecedented. Until public services have built up the IT defence capacity to deal with this, we cannot normalize this. If a country did this to another country, it should be treated as a war crime in the same way that targeting a hospital or an orphanage or other critical civilian infrastructure would be.
Complacency is a choice and we must not be complacent.
They also aren't the ones screaming about how close they are to destroying the world. They're approaching the tech like building a tool rather than a god.
OpenAI and Anthropic have shown us that they have a strong incentive to leave holes in their systems so they can use them for marketing and regulatory capture.
This is extra embarrassing. The police departments spam filter caught it before Anthropic did.
What it it submits false data as here?
What is it DDOSs a website by mistake?
What if it wastes a lot of time and resources?
What if it decides it needs to hack a website using a vulnerability it found?
These things are very unpredictable and should not be allowed in the open internet except in read mode (and even that doesn’t always work as we have seen).
Why are these tests being made using other people’s resources and polluting the common wealth of our public spaces with slop?
Don’t get me wrong - think Anthropic is acting with not enough scrutiny or punishment here, but the world is already extremely lenient towards this behaviour. Why hold them to a higher standard?
Hacking websites and submitting false police reports.
These are relatively brand new systems that process an incredible amount of data to form their "world view". The word non-deterministic gets thrown around a lot, but you have to understand that there's absolutely nothing deterministic about these architectures. The only way to know that certain qualities could emerge is to observe the qualities emerging.
Giving an agent instructions that, for example, instruct it to only perform GET requests, and then observing that the agent does not always respect that request, is not a failure of security or configuration: it's data being gathered.
Yeah, we're going to become more diligent about the protections that we put in place beyond any level of protection that we've ever employed before. You can say that we have decades of security research and experience, but we're watching all of that fall more and more day by day, finally putting a real delta on how secure we thought we were versus how secure we actually are [1]. Additionally, adversaries have never existed inside of the systems that we hoped to secure in the first place.
So go ahead, enumerate all of the ways in which you think that you can lock down these systems, but do realize that nobody has actually solved this problem adequately yet.
[1] https://x.com/PaulosYibelo/status/2106378929158135903
"No way to prevent this", says corporation that deliberately built a framework that to make it possible.
> is not a failure of security or configuration: it's data being gathered.
"This isn't a failure of me to leash my new dog, the dog biting your child's face off when I was not present is an important learning experience!